[ubuntu-za] My Ubuntu 9.10 has been hacked. Need help

Alf Stockton alf at stockton.co.za
Tue Jul 6 13:47:33 BST 2010


On 06/07/2010 12:52, Jason Plank wrote:
> Hi Guys
>
> I hope someone can help or give me some advice. I've got Ubuntu 9.10
> running on one of our pc's at work as a LAMP server for joomla and I've
> also got virtualbox installed running NT4 workstation for a project
> we're working on. My problem is that some idiot has hacked the system
> and I can't seem to block him. I've tried turning of Remote Desktop, but
> he still get's in and changes settings. I've also disabled a whole bunch
> of startup daemons. We're also behind a DLINK DFL-210 firewall and I've
> set it to drop incoming RDP and telnet connections, but he still seems
> to be getting in. Can anyone give any ideas as to what I can do, other
> than format and redo the system?
>
To identify who logged into my server and from where I have entered the 
following in my /etc/profile on my debian server.

echo "Subject: Login on `hostname`" > ./logon.txt
echo "by `who | awk '{print $1}'` from URL `who | awk '{print $5}'`" >> 
./logon.txt
/usr/sbin/sendmail -t alf at stockton.co.za < ./logon.txt


-- 
---

Regards,
Alf Stockton	www.stockton.co.za

To err is human, to forgive canine.



More information about the ubuntu-za mailing list